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Abstract 

We examine a situation that n eavesdroppers attack the Bennett-Brassard cryptographic pro- 
tocol via their own optimal and symmetric strategies. Information gain and mutual information 
with sender for each eavesdropper are explicitly derived. The receiver's error rate for the case of 
arbitrary n eavesdroppers can be derived using a recursive relation. Although first eavesdropper 
can get mutual information without disturbance arising due to other eavesdroppers, subsequent 
eavesdropping generally increases the receiver's error rate. Other eavesdroppers cannot gain in- 
formation on the input signal sufficiently As a result, the information each eavesdropper gains 
becomes less than optimal one. 
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I. INTRODUCTION 



Quantum cryptography is one of the major applications of quantum information 
theories While other applications such as quantum teleportation and quantum com- 
puter require tens or even thousands of qubits, the quantum cryptography scenario such as 
BB84 protocol^ can be implemented, at least theoretically, using only single qubit tech- 



nology. This is main reason why the quantum cryptography based on BB84 or Ekert91 
now at the stage of the industrial era ^] . 



According to the usual BB84 protocol the sender (Alice) sends a single qubit to the 
receiver (Bob) by choosing randomly one of the conjugate bases {\x), \y)} and {\u), \v)}, 
where 

l«> = ^ (l*> + l*> = ^ (I*) - |y» . (1-1) 

Then Bob performs a quantum mechanical measurements in these bases. After measure- 
ments, Alice and Bob communicate with each other via classical public channel and establish 
a secret quantum key by using only those cases in which the bases of Alice and Bob coincide. 

How much information an eavesdropper (Eve) can gain when Alice and Bob perform the 
usual BB84 scheme? The answer of this question is important to check the security of the 
quantum cryptography. In this reason many authors examined the various strategies with 
one- and two-dimensional probes 0, Q, [§], [9}. Among them Ref.js] derived the optimal (or 
maximal) mutual information between Alice and Eve as a function of the disturbance D in 
the BB84 protocol. The final result can be summarized as follows: 
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where X xy (or I uv ) is the optimal mutual information when Alice sends a signal to Bob via 
x — y (or u — v) basis, and 4>(z) = (1 + z) log 2 (l + z) + (1 — z) log 2 (l — z). The constants D xy 
and D uv denote the disturbances in these bases. The most different point of the quantum 
cryptography from the classical one is the fact that Eve cannot get information from the 
trusted parties without arising the disturbance. This implies that the quantum scheme is 
more secure than the classical cryptography. 

Recently, many different cryptographic protocols have been studied from the purely the- 
oretical ground (at least at current stage) even if most quantum cryptography has been 
demonstrated by making use of either one of BB84 or Ekert91 protocols. One of the moti- 
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FIG. 1: Plot of D-dependence of the optimal mutual information when Alice and Bob use the 
various different protocols. 

vations for searching other protocols is to strength the security against eavesdropping. The 



simple extended protocol is a six-state protocol [10, llll]. In this protocol Alice sends a sig- 
nal to Bob after choosing randomly one of three conjugate bases {\x),\y)}, {\u),\v)} and 
{\w), \z)}, where 

k) = 4| (k> + Ay)) l*> = 4= (k> - i\v)) ■ (i-3) 

The basis {\w), \z)} corresponds to the circular polarization if Alice and Bob use a photon 
polarization as a qubit. The optimal mutual information between Alice and Eve is plotted in 
Fig. 1, which implies that the six-state protocol is more secure than usual four-state BB84 



against eavesdropping. Another extended protocol Jj], 13, Q, Q is that Alice and Bob use 
qutrit (d = 3) or more generally qudit (d — 4, 5, • • • ) instead of a qubit. The optimal mutual 
information in this protocol is also plotted in Fig. 1 when d = 3, 4, and 5. Fig. 1 indicates 
that the protocol with <i-level system is more secure against eavesdropping with increasing d. 
Furthermore, the quantum cryptography with continuum jl6] and noisy states[l3] are under 
investigation. However, all of these other protocols seem to be far from embodiment in a 
few years from the aspect of experimental science. 

In this paper we would like to explore the situation where many eavesdroppers (Evel, 
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FIG. 2: Quantum circuit expression for the optimal eavesdropping strategy. Fig. 2(a) and (b) 
represent the optimal strategy when Alice sends a signal using x — y or u — v basis respectively. 
The bottom two lines belong to Eve and the top line to Alice. Time advances from left to right. 

Eve2, • • • ) attack the BB84 protocol optimally. We assume that all of the eavesdroppers 
think they are unique eavesdropper. Our computation is based on the quantum circuit ex- 
pression of the optimal eavesdropping strategy jl8]. This paper is organized as follows. In 



section II we review Ref.[l8[ briefly. In this section we develop a computational technique, 
which is useful when many eavesdroppers try to attack optimally. In section III we examine 
the situation where Evel and Eve 2 attack the usual BB84 protocol. Information gain G« 
and mutual information /W are explicitly computed, where i = 1 or 2 corresponds to Evel 
and Eve2 respectively. When Evel and Eve2 attack via symmetric optimal strategy, we com- 
pute the Bob's error rate or disturbance Db,2 explicitly, where the subscript "2" denotes the 
two eavesdroppers. It turns out that both optimal strategies fail. Although Evel can gain 
information on Alice's signal as much as possible, Eve2 increases the disturbance or Bob's 
error rate. For Eve2 she cannot gain information sufficiently due to Evel's disturbance. 
In section IV we examine the situation where three eavesdroppers attack the BB84 proto- 
col. The mutual information for each eavesdropper is analytically derived. Furthermore, 
Bob's error rate Dg,3 is also explicitly derived on condition that all eavesdroppers use the 
symmetric strategies. In section V we have generalized the results of the previous sections. 
When n eavesdroppers attack, the mutual information for each eavesdropper is analytically 
derived. Also the recursive relation of the Bob's error rate is derived. It turns out that 
all optimal strategies eavesdroppers choose eventually fail except very rare cases. Finally a 
brief concluding remark is given. 
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II. ONE EAVESDROPPER 



The quantum circuits for the optimal eavesdropping in x — y and u — v bases are given 
in Fig. 2. The top line belongs to Alice and Bob, and the bottom two lines to Eve. In order 
to perform the optimal eavesdropping strategy Eve prepares the initial states as following: 



e 



) = y/l - A uv \x) + y/A^\y) = y/l - D uv \u) + </I>^\v) (2.1) 



\fo) = a/1 - D xy \x) + y/D// y \y) = a/1 - A xy \u) + a/AJ-u) 

where A and D are related, when they have same subscripts, through the formula 

A = i - y/D{l-D) D = \- a/A(1-A). (2.2) 

If Alice sends a signal using x — y basis, Fig. 2(a) shows that the entangled states between 
Alice and Eve becomes 

\x) — > \X) = a \xxx) + a x \yxy) + a 2 \xyx) + a 3 \yyy) (2.3) 
\v) ~> \Y) = oc Q \yyx) + a x \xyy) + a 2 \yxx) + a 3 \xxy) 

where 



a = a/1 - A^a/1 - D xy a x = y/l - A u „a/A^ (2.4) 
«2 = V A M1 , a/1 — D xy a 3 = a/ A uv y/ A xy . 

For later use it is necessary to express Eq. f)2.3p more compactly. This can be achieved by 

3 3 

|Jf) = ^a i |i) 2 |i) 4 \Y) =^0^ + 1)2^ + 2)4 (2.5) 

i=Q i=0 

where \j)2 and |j)4 means |j modulo 2) and |j modulo 4). Thus and |j ) 4 represents 
the one- and two-qubit states respectively with ordering x and y for \j) 2 and xx, xy, yx and 
?/y for |j) 4 . This compact notation will be usefully used in the following sections when many 
eavesdroppers attack. 

When Alice sends a signal using u — v basis, the usual control-NOT gate changes 

\uu) — > \uu) \uv) — > \vv) \vu) — > |w) |ff) — > (2.6) 

Thus the control-NOT gate in x — y basis can be easily understood in u — v basis by 
exchanging the control gate with target gate. This is a reason why Fig. 2(b) used in u — v 
basis is different from Fig. 2(a). 



Now, we want to show that the entangled states (12. 3p with suitable POVM measurement 
enables Eve to get information optimally. The complete set of the positive operators, which 
is used for POVM, can be derived generally as projective operators onto the eigenvectors of 



F xy = p x - p y , where [19| 



p x = Tr Alice \X)(X\ Py = Tr^ ce |Y)(Y|. (2.7) 

For our case the complete set of the positive operators is {E , E\, E 2 , E 3 } with E = \xx){xx\, 
Ei = \xy)(xy\, E 2 = \yx)(yx\, and E 3 = \yy)(yy\. Then it is easy to compute P Xi = 
(J|l ® E\\I) with / = X or Y and % = x or y, which is the probability that Eve detects 
outcome A when Alice sends a signal i: 

Pox = al P lx = a\ P 2x = a\ P 3x = a\ (2.8) 
P 0y = a\ Piy = aj P 2y = a 2 P 3y = a\. 

Using Eq.(T22]), one can compute q x = (l/2)(P Ax . + P Xy ) and Q iX = (l/2)P Xi /q x : 

Qo = ^- Dxy) qi = -D xy q 2 = -(l-D xy ) q 3 = -D xy (2.9) 

and 

Qxo — 1 — A uv Q x i = 1 — A MV Q x2 = A uv Q x3 = A uv (2-10) 

QyO A uv Qyl A uv Qy 2 1 A uv Qy3 1 A uv . 

The quantity q x is a probability that Eve has outcome A when Alice uses x — y basis. The 
quantity Qi X is posterior probability on the Eve's guess after she has a outcome A. Then 
the information gain is defined as G x = \Q xX — Q yX \, which, for our case, is A-independent: 



G x = 1 — 2A UV = 2a/ D uv (1 — D uv ). (2.11) 
Thus, the mutual information X AE between Alice and Eve reduces to 

T AE = ^^qxHGx) = 1<P[2D UV (1 - D uv )\ (2.12) 

A 

where <f>(z) = (1 + z) log 2 (l + z) + (1 — z) log 2 (l — z). 

Now, let us derive the Bob's error rate, usually called disturbance when Alice sends a 

signal using the x — y basis. First, we consider the following quantities: 

{U\B U ®E X \U) {V\B V ®E X \V) 
Xu ~ (U\t®E x \U) v (V\t®E x \V) [ 6) 



where \U) = {l/y/2)(\X) + \Y}), \V) = (1/V2)(|X> - \Y)), B u = \u)(u\, and B v = \v)(v\. 
These are probabilities Bob gets a wrong result conditioned upon Alice sending \u) or \v), 
and Eve measuring A. Computation of d\ u and d\ v is straightforward. The result is that 
d Xu is identical to d Xv and they are also A-independent as follows: 

d Xu = d Xv = d x = D uv . (A = 0, 1, 2, 3) (2.14) 

Then the Bob's error rate D B is given by 

D B = Y,Qxd x = D uv . (2.15) 

A 

Thus Eq.f l2.12p can be re- written as 

X AE = ^[2D B (1-D B )] (2.16) 

which is the optimal mutual information derived in Ref. 9j when Alice sends a signal using 
x — y basis. If Alice uses u — v basis, we should repeat the previous calculation using Fig. 
2(b). The final result is identical with Eq. fl2.16p except D B = D xy . Thus, the strategies 
expressed by Fig. 2 give an optimal information to Eve regardless of the basis Alice is using. 



III. TWO EAVESDROPPERS 



Now we consider a situation that two eavesdroppers, Evel and Eve2, attack the usual 
BB84 protocol. We assume that Evel and Eve2 do not know each other and they use their 
own optimal strategies. Thus corresponding quantum circuit should be Fig. 3 when Alice 
sends a signal using x — y basis. From now on we will use the superscript (z) to distinguish 
the quantities (or states) which belong to Evel and Eve2. 

Using the compact notation used in Eq. fl2.5p . one can derive the entangled states at the 
stage represented dotted line in Fig. 3: 

3 

\x)^\X)= |z + J ) 2 |z) 4 |2z+j) 4 (3.1) 

i,j=0 
3 

\y) -> l^> = E a { Sf\i + j + + 2) 4 |2z + j + 2) 4 . 

i,j=0 

In order to derive the POVM elements for Evel we construct the operator 

rg = - p y l) (3-2) 
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FIG. 3: Quantum circuit expression for the situation where two eavesdroppers Evel and Eve2 
attack the usual BB84 protocol when Alice sends a signal to Bob using x — y basis. The top line 
belongs to Alice, next two lines to Evel, and bottom two lines to Eve2. If Alice uses a u — v basis, 
this figure should be modified by exchanging the control gates with target gates in all control-NOT 
gates. Time advances from left to right. 

where 

Px 1] = Tr A>E2 \X){X\ pW = Tr AE2 \Y){Y\. (3.3) 

In Eq. ( 13.31) Tr^ ^ means a partial trace over Alice and Eve2's qubits. Then it is easy to 
compute the eigenvectors of T^y , which gives the complete set of the positive operators 
{fifUf'.fiJ 1 ',^ 15 } to Evel, where 

= \xx) 2fi {xx\ e{ 1] = \xy} 2 , 3 (xy\ Ep = \yx) 2>3 (yx\ = \yy) 2}3 (yy\- (3.4) 

The subscript 2, 3 means qubits of second and third lines in Fig. 3. By same way one can 
construct the complete set of the positive operators for Eve2, which is 

E o 2) = 1^)4,5 (xx I e{ 2) = \xy) 4i5 (xy\ E { 2 2) = \yx) 4j5 (yx\ Ef> = \yy)^{yy\- (3.5) 

Then the remaining calculation for the mutual informations I AEl between Alice and Evel, 
and X AE2 between Alice and Eve2 is straightforward. The information gains G^ for Evel 

(2) 

and G\ for Eve2 turn out to be A-independent as following: 

G? = 1 - 2A« Gf = (1 - 2Al 2 j)(l - 2£>W). (A = 0, 1, 2, 3) (3.6) 

Therefore from a comparison of Eq. fl3.6p with Eq.f l2.lll) Evel seems to be able to get in- 
formation as much as the case of unique eavesdropper. This is due to the fact that Evel 
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attacks the BB84 protocol earlier than Eve2 and therefore, gathers information without per- 
turbation arising due to Eve2. However, this does not mean that Evel's optimal strategy is 
succeeded. As shown in Fig. 1 optimality of the eavesdropping does not uniquely depend 
on the quantity of information that eavesdropper can gain. In order to get success in the 
eavesdropping, eavesdropper should decrease the disturbance as much as possible. These 
two factors, increase of information gain and decrease of disturbance, determine the success 
or failure of the optimal strategy. As will be shown shortly, Evel's optimal strategy fails be- 
cause Eve2 increases Bob's error rate. For Eve2 the information gain involves an interesting 
factor 1 — Dxy- Thus Eve2's information gain depends on the Evel's choice of Dxy. This 
is manifestly due to the fact that Eve2 performs her optimal strategy after Evel. If Evel 
chooses Dxy = 0, Eve2 can get information as much as Evel if Auv = Auv- This indicates 
that Eve2 can increase her information gain if Evel does not disturb the signal Alice sent 
to Bob. The mutual information 2 AEl and X AE2 reduce to 



Now, let us turn into the Bob's error rate. Unlike the unique eavesdropper case discussed 
in the previous section the situation is very complicated. In this case it could happen that 
Evel's disturbance and Eve2's successive disturbance does not generate an error to Bob. 
Thus equation corresponding to Eq. (12.131) in previous section should have one more index, 
i.e. d\ u — > dxx> u and d\ v — > d\y v . Since, furthermore, both optimal strategies Evel and Eve2 
have chosen do not get success, we expect to have d\y u ^ d\y v . Thus we should compute 
the Bob's error rate separately when Alice sends \u) and \v). Since computation in this way 
needs long and tedious calculation, we will try to make the situation more simple. 

To make the situation more simple we assume that both eavesdropping strategies are 
symmetric, i.e. D xy = Duv and Dxy = Duv ■ In this case we can compute the Bob's error 
rate directly from the entangled states Eq. (13.11) . which is 



0, Db becomes which is Bob's error rate if Evel is an unique eavesdropper. If = 0, 
Db becomes which is also Bob's error rate if Eve2 is an unique eavesdropper. The 
general Bob's error rate becomes nice combination of D^ and D^ 2 ' . 





(3.7) 



D B = D^(1-D^)+D^(1-D^). 



(3.8) 



In Eq. (13.81) we omit the subscript because it is useless in the symmetric strategies. If 
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FIG. 4: Plot of /^-dependence of l AEl (Fig. 4(a)) and 1 AE2 (Fig. 4(b)). The dotted line is 
a -D#-dependence of the optimal strategy derived in Eq. (jl.2p . The monotonically decreasing line 
corresponds to I AB , mutual information between Alice and Bob. Fig. 4(a) implies that the mutual 
information of Evel is less than the optimal one except = 0. This is due to the fact that 
Eve2's eavesdropping process generally increases the Bob's error rate. Fig. 4(b) implies that the 
mutual information of Eve2 is also less than the optimal one except = 0. This is due to the 
fact that Evel's eavesdropping process generally decreases the information gain for Evel. 

Fig. 4 is ^-dependence of 2 AEl (Fig. 4(a)) and X AE2 (Fig. 4(b)). We plot l AEl in 
Fig. 4(a) when = 0.1, 0.2 and 0.3 respectively. For comparison we plot the optimal 
information X opt (see Eq. fll.2l) ) and mutual information T AB between Alice and Bob defined 

1 AB = 1 + D B log 2 D B + (1 - D B ) log 2 (l - D B ) (3.9) 

together. As Fig. 4(a) indicates, Evel's mutual information with Alice are in general smaller 
than X opt when ^ 0. If approaches to zero, X AEl approaches to X opt . This means 
that failure of the Evel's optimal strategy is only due to the fact that Eve2 increases the 
disturbance. We plot X AE2 in Fig. 4(b) when = 0.1, 0.2 and 0.3 respectively. For 
comparison we plot X opt and X AB together. As expected X AE2 approaches to X opt in the 
limit £> (1) -> 0. In this case, however, X AE2 decreases very rapidly compared to X AEl with 
increasing L>«. This seems to be mainly due to the fact that Eve2's information gain is 
affected by Evel as shown in Eq. fl3.6p . 

In Fig. 5 we plot X AEl and X AE2 together as functions of and D^K In most region 
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FIG. 5: The D^- and -dependence of l AEl and 1 AE2 . In most region I AEl is larger than 
I AE2 . This seems to be mainly due to the factor 1 — D^y in Eq. (|3.6p . However, in the small 
region X AE2 becomes larger than X AEl because this multiplication factor becomes nearly unit in 
this region. 

I AEl is larger than X AE2 . This is also due to the .D ^-dependence of Eve2's information gain 
Gf\ In the small £>W region, however, X AE2 becomes larger than I AEl . This is due to the 
fact that Evel cannot gain information without increasing as Eq. (13.61) indicates. 

IV. THREE EAVESDROPPERS 

In this section we consider a situation that three eavesdroppers called Evel, Eve2, and 
Eve3 attack the usual BB84 protocol. As previous section we assume that they think they 
are unique eavesdroppers and choose their own symmetric strategies. Thus corresponding 
quantum circuit should be Fig. 6 when Alice sends a signal using x — y basis. 

Using the compact notation used in Eq. fl2.5p . one can derive the entangled states at the 
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FIG. 6: Quantum circuit expression for the situation where three eavesdroppers Evel, Eve2, and 
Eve3 attack the usual BB84 protocol when Alice sends a signal to Bob using x — y basis. The top 
line belongs to Alice, next two lines to Evel, next two lines to Eve2 and bottom two lines to Eve3. 
Time advances from left to right. 

stage represented as a dotted line in Fig. 6. The final result becomes 

3 

\x)^\X)= «f } «f } «i 3) |i + j + fc) 2 |i) 4 |2i + j) 4 |2i + 2j + A;) 4 (4.1) 

i,j,k=0 
3 

\v) ^\ Y ) = Yl al 1) af ) aP\i + j + k + l) 2 \i + 2) 4 \2i+j + 2)42i + 2j + k + 2) 4 . 

i,j,k=Q 

Then, it is straightforward to construct the complete sets of the positive operators for 
eavesdroppers' POVM measurements. Following the similar calculational procedure, one can 
compute the information gain for each eavesdropper. The final result can be summarized as 
following: 

= 1 - 2A {1) = 2 A / J D( 1 )(1 -IX 1 )) (4.2) 
G? } = (1 - 2A (2) )(1 - 2D W ) = 2(1 - 2D (1) )- v Ad( 2 )(1-D( 2 )) 

Gf = (1 - 2A (3) )(1 - 2D (1) )(1 - 2D (2) ) = 2(1 - 2D (1) )(1 - 2D^)^D^(1 - D^). 

Note that we remove all subscripts because they are not necessary in the symmetric strategy. 
Eq. (14.21) exhibits a simple pattern: the information gain for each eavesdropper is a multi- 
plication of her own 1 — 2A factor with 1 — 2D factor of other eavesdroppers who perform 
their own strategies earlier. Using this rule, we can compute the information gains when 
n eavesdroppers attack with arbitrary number n without explicit calculation. The mutual 
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informations I AEl , X AE2 and X AEi reduce to 

? AEl = \* 1 ae > = \<P (flf ) I** = I* {Gf) . (4.3) 

Finally Bob's error rate Db can be read straightforwardly from Eq. (14.1j) : 

D B = [D™ (1 - D®) + (1 - D«)] (1 - D^) + [D^D® + (l - D&) (l - D (3) . 

(4.4) 

When Z)( 3 ) = 0, Eq. (14.4H exactly coincides with Eq. ( 13.81) . If, furthermore, = or 

= 0, Eq.f l4.4p reduces to Eq. ( 13.81) with changing only Eve index. 




0.0 0.1 





FIG. 7: Plot of Independence f l AEl (Fig. 7(a)), 1 AE * (Fig. 7(b)), and 1 AE * (Fig. 7(c)). 
The optimal mutual information I op t and Bob's mutual information Z AB are plotted together for 
comparison. This figure indicates that all optimal strategies performed by Evel, Eve2, and Eve3 
turn out fail. 



Fig. 7 is the plot of ZVdependence of X AEl (Fig. 7(a)), X AE2 (Fig. 7(b)), and l AEs 
(Fig. 7(c)). We fixed = = 0.1, 0.2 and 0.3 in Fig. 7(a), = = 0.1, 0.2 
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FIG. 8: Schematic diagram for the situation that n eavesdroppers optimally attack the usual BB84 
protocol performed by two trusted parties, Alice and Bob. We assume that Alice sends a signal 
using x — y basis. If Alice uses u — v basis, this diagram should be modified by exchanging all 
control gates with target gates. 

and 0.3 in Fig. 7(b), and = = 0.1, 0.2 and 0.3 in Fig. 7(c). For comparison 
the optimal mutual information X opt and Bob's information X AB are plotted together. As 
Fig. 7 indicates, all optimal strategies turn out to fail. Especially, Eve3 gains very little 
information compared to optimal one. This is mainly due to the fact that Evel and Eve2 
disturb the Alice's signal before Eve3 starts her optimal strategy. Comparision of Fig. 7 
with Fig. 4 indicates that mutual informations in the case of three eavesdroppers are overall 
less than those in the case of two eavesdroppers. This seems to be due to the fact that 
Eve3's disturbance of Alice's signal decreases X AEl and X AE2 in the disturbance-information 
diagram. 



V. CONCLUSION 



In this paper we have examined the situation that many eavesdroppers attack usual 
BB84 protocol via their own symmetric optimal strategies. If the number of eavesdroppers 
is arbitrarily n as shown in Fig. 8, Eq. fl2.lip . (13. 6p and (14.21) imply that their information 
gains are 

G {j) = (1 - 2A (J) ) (1 - 2D W ) ■ • ■ (1 - 2D {j - 1] ) (j = 1, • • • , n) (5.1) 
and their mutual informations with Alice are 

1 U) = \<P • (j = l,---,n) (5.2) 
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Furthermore, Eq. fl2.15p . (13.81) and (14. 4p imply that Bob's error rate in the presence of n 
eavesdroppers can be computed as follows. In order to distinguish the number of eaves- 
droppers in the Bob's error rate, we use one more index such as Dbj, which is Bob's error 
rate when j eavesdroppers attack with symmetric optimal strategies. Then Db^ can be 
computed from Db^-i by a recursion relation 



D B ,n = D B ,n-l (1 " ^ + D B ,n-l 



D (n) . (5.3) 

£)(n-l) ^l_£)(n-l) 



Since we know Db,i exactly, one can compute Db,u recursively. 

Eq. (15.21) and (15. 3p enable us to plot the disturbance-information diagram for any eaves- 
droppers. As commented already in the previous sections, all eavesdroppers' optimal strate- 
gies cannot succeed eventually except very rare cases. Although the first eavesdropper can 
obtain mutual information without disturbance arisen due to the other eavesdroppers, sub- 
sequent eavesdroppers increase the Bob's error rate. This makes the mutual information of 
the first eavesdropper lower than the optimal one in the disturbance-information diagram 
except = ■ ■ ■ = = 0. The last eavesdropper cannot gain information due to the 
disturbance of the Alice's signal arising due to the previous eavesdroppings. Thus the last 
eavesdropper's optimal strategy fails except D^ 1 ' = ■ ■ ■ = Z)*™ -1 ) = 0. Similar reasons make 
all optimal strategies fail. 

It seems to be of interest to extend our results to the case of asymmetric eavesdropping. 
Probably it needs very long and tedious calculation. Furthermore, asymmetric eavesdropping 
strategy may be not important practically because Alice and Bob can notice the presence 
of eavesdropper more easily than the symmetric case. However, from the purely theoretical 
point of view it is interesting issue because it may give origin of information gain and Bob's 
error rate. 

Although much attention has been paid to the optimal strategy in the various protocol, 
the properties of the non-optimal case are not examined sufficiently Since, however, the 
effect of decoherence makes it impossible for eavesdropper to perform the exactly optimal 
one, it seems to be more important to explore the strategies near to optimal from the aspect 



of the practical reason. Recently, it is found 



201 ] that the quantum resonance occurs in the 



Bob's error rate when Eve takes a near-optimal strategy. We believe that there are other 
new and interesting properties in the eavesdropping strategies near to optimal one. We 
would like to explore this issue in the future. 
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